pyhanko-certvalidator

What it is and what it does

pyhanko-certvalidator is a Python library for validating X.509 certificate chains, originally forked from wbond/certvalidator but significantly evolved for use in pyHanko. It performs comprehensive path validation including signature verification (RSA, DSA, ECDSA, EdDSA), name chaining, validity date checks, and extension processing. The library supports revocation verification through both CRL (including indirect and delta CRLs) and OCSP (including delegated responders), with configurable failure modes and response caching. It can validate certificates at a specific point in time, enforce name constraints, and handle attribute certificates.

The library has been refactored to use asynchronous I/O throughout, though synchronous wrappers remain available for backward compatibility. It depends on asn1crypto, cryptography, oscrypto, uritools, and requests. The default OCSP and CRL clients use requests for HTTP operations, with an optional aiohttp-based implementation available for more efficient async use. Bug reports and questions are routed through the pyHanko project rather than this repository directly.

Use it for:

• Validate certificate chains in PKI-aware applications before trusting certificates for TLS or code signing
• Perform revocation checks via CRL or OCSP to ensure certificates have not been compromised or revoked
• Validate certificates as they were at a specific historical date for compliance or forensic purposes
• Enforce certificate policy constraints and name constraints in security-critical workflows
• Build certificate path validation into document signing or verification tools (e.g., PDF signing)

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Validates X.509 certificate paths with support for revocation checks (CRL and OCSP), point-in-time validation, and policy constraints.

Yes. The package is actively maintained, has no known vulnerabilities, supports current Python versions, and provides comprehensive X.509 validation with low install friction. Suitable for production use in PKI-aware applications. Note that the synchronous API is deprecated in favor of async equivalents, so new code should plan for async patterns.

Install

pyhanko-certvalidator on PyPI

pip install pyhanko-certvalidator

uv add pyhanko-certvalidator

poetry add pyhanko-certvalidator

Installing pyhanko-certvalidator

Before you install

Low friction install with five stable runtime dependencies. Actively maintained with a release within the past month and recent commits. Supports current Python versions (3.10+).

License in practice

MIT license permits commercial and private use with minimal restrictions; suitable for most projects.

Quickstart

pip install pyhanko-certvalidator

from pyhanko_certvalidator import CertificateValidator
validator = CertificateValidator()
# Use validator.validate_usage() or async equivalents for certificate validation

Requires Python 3.10 or higher. Most high-level APIs are now async-first; synchronous wrappers exist but are deprecated.

Verify before relying

• Whether the synchronous API wrappers are stable enough for production use despite deprecation status
• Performance comparison between requests-based (default) and aiohttp-based OCSP/CRL clients
• Completeness of documentation for migration from synchronous to async patterns

Package facts

Evidence: pyhanko_certvalidator-0.31.4-py3-none-any.whl

Keywords: crypto, pki, x509, certificate, crl, ocsp

Tags

More Cryptography packages